[ca] Document instructions for certificate renewal.

diff --git a/ca/README b/ca/README
index 3270c050d130960b46b524cf8f01c4b72d8ff7d7..ae17dc8e6e79d4a35b1823f0475f34c70db29a61 100644 (file)
--- a/ca/README
+++ b/ca/README
@@ -57,6 +57,14 @@ browser [7].
 $ openssl pkcs12 -export -inkey <name>.key -in <name>.crt -out <name>.p12
 ```
 
+Renew
+-----
+
+The CRL file expires after 30 days by defualt. Renew it by recreating the files.
+
+1. Create new `crlfile` and `ca.crl`.
+2. Restart the service which uses `ca.crl`.
+
 [1] https://stackoverflow.com/a/71024854
 [2] https://stackoverflow.com/a/41366949
 [3] https://gist.github.com/croxton/ebfb5f3ac143cd86542788f972434c96